topic Re: AAA problem with Nexus in Network Access Control

AAA problem with Nexus

tiwang — Mon, 11 Mar 2019 00:40:44 GMT

Hi out there

I am trying to get the config right on our nexus switches to use our local ACS server for authentication and command authorization. I of course want to make yuse of a local user-database if the connection to the central ACS server fails. But I cannot get the syntax correctly - can some please see what I am doing wrong here - se here - I have defined this on my nexus 5020:

I have defined a tacacs+ group named TACSRV

aaa group server tacacs+ TACSRV

aaa authentication login default group TACSRV

aaa authentication login console local

aaa authorization commands default group TACSRV

aaa authentication login error-enable

how should it look to first ask the servers in TACSRV and if not succesfully the local database?

best regards /ti

Re: AAA problem with Nexus

Dan-Ciprian Cicioiu — Wed, 29 Dec 2010 11:46:57 GMT

Hello ,

You should add at the end of each authentication and authorization set "local"

Like this :

aaa authentication login default group TACSRV local
aaa authorization config-commands default group TACSRV local
aaa authorization commands default group TACSRV local

Dan

Re: AAA problem with Nexus

tiwang — Wed, 29 Dec 2010 11:47:27 GMT

hi out there

ok - too stupid - it is of course just the cli which doesn't show me the possibilty - the correct syntax is

aaa authorization commands default group TACSRV local

but - how can I use this command

aaa authorization commands default group TACSRV local

Can I define a collection of commands which is not default? Or what is this keyword intended to be used for?

Re: AAA problem with Nexus

Dan-Ciprian Cicioiu — Wed, 29 Dec 2010 11:50:13 GMT

Hi ,

For now , as far as i now , there is no posibility to configure the level commands as on IOS

You have only :

commands Authorization for all exec-mode comamnds
config-commands Authorization for config comamnds

Dan